The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill analyzes LLM traces, which are considered untrusted data originating from external sources. This creates a potential surface for indirect prompt injection if the traces contain instructions the agent might follow. 1. Ingestion points: posthog:query-llm-trace (fetches trace content in SKILL.md) and posthog:execute-sql (fetches event properties). 2. Boundary markers: Absent; no specific delimiters are defined in the skill instructions to separate untrusted data from the agent's context. 3. Capability inventory: The skill uses posthog:execute-sql, posthog:query-llm-traces-list, posthog:query-llm-trace, and posthog:read-data-schema (SKILL.md) to interact with project data and generates natural language summaries. 4. Sanitization: Absent; no filtering or escaping of trace content is mentioned before interpretation by the agent.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill queries user PII such as emails and names. It mitigates exposure risk by providing clear instructions to the agent to only select specific label columns and to avoid serializing the full person.properties blob, which prevents the accidental leakage of sensitive metadata.

analyzing-expensive-users